Identify the token’s scope, lifetime and permitted transmission method. Determine which proxies, application logs and analytics tools record requests.

1. Send the token through the provider’s documented authorization header or other supported secure mechanism. Avoid putting a credential in a URL unless the protocol explicitly requires it.

2. Use HTTPS and keep certificate verification enabled. Protect token storage in the server environment or approved credential manager.

3. Redact authorization headers, cookies and secret query parameters in logs. Review error reports and traces that capture outgoing requests automatically.

4. Share request identifiers, status codes and sanitized examples when asking for support. Replace real tokens with clear placeholders before exporting diagnostics.

5. Rotate or revoke a token that was exposed and review its use. Remove it from current files and investigate older logs or artifacts.

Inspect a controlled request through the logging path and confirm the token is not stored in readable diagnostic output. Verify the integration works with its intended narrow permissions.

If a token appears in a shared URL, deleting the message does not invalidate copies. Revoke it through the issuing service and update authorised consumers.

• Recording useful API error details without secrets
• Rotating an application secret without breaking active traffic
• Protecting production secrets in CI jobs
• Troubleshooting browser CORS errors for an API

• OWASP REST security
• OWASP logging